low3.1
CVE-2026-109332
Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhos…
Impact
Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with a localhost Origin visited by a victim can read unauthenticated endpoints like /health cross-origin.
Affected products
| Product | Affected versions |
|---|---|
| Network-AI (Npm Network-Ai) | before 5.15.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.